Skip to main content
| Three separate settings decide what happens to a pull request before it merges: This guide shows how to combine them so that routine pull requests move quickly and higher-risk ones get human review. The steps use GitHub.

​
An approval is not a merge

CodeRabbit’s approval counts as one approving review and does nothing else. A pull request can merge only when it meets every GitHub requirement, such as required status checks, other required reviews, code owner reviews, and no merge conflicts. Automatic Approvals does not fix those problems or merge the pull request. Whoever merges it, a person, GitHub auto-merge, or a Triage merge rule, still has to meet the same requirements.

​
Choose a policy

The policies below assume that CodeRabbit is the only bot that submits approving reviews. If other bots approve too, their approvals may count toward the same requirement. A required approval count does not say who must approve. Two required approvals can always come from two people, so these policies never make CodeRabbit’s approval mandatory. To require a review from a specific team, add code owners and turn on Require review from Code Owners.

​
CodeRabbit or a person

Use this policy when a clean CodeRabbit review is enough for the pull request to merge. Require one approval in GitHub and turn on Automatic Approvals:
.coderabbit.yaml
CodeRabbit approves once its approval requirements are met, or a person approves instead. With a single required approval, an author’s @coderabbitai approve comment can satisfy the requirement without a completed review of the latest commit or passing Pre-Merge Checks. To stop authors from doing this on their own pull requests, set reviews.allow_author_approval: false. See Approve or resolve on demand.

​
CodeRabbit plus a person

Use the same CodeRabbit configuration, but require two approvals in GitHub. A CodeRabbit approval then leaves one approval for a teammate. Two people can also approve the pull request without waiting for CodeRabbit.

​
People for higher-risk changes

Require two approvals in GitHub and add a merge risk limit:
.coderabbit.yaml
When a pull request’s Merge Risk is Minimal or Low, CodeRabbit can approve it, and one person completes the pair. When Merge Risk is Moderate or above, or unavailable, CodeRabbit withholds its approval and two people must approve. For example, a pull request has its review comments resolved but Moderate Merge Risk. Marking threads resolved does not change the rating; it changes only when a later review finds the risk addressed in the code. Two people can review the remaining risk and approve, or the author can change the code and let CodeRabbit review the new commit. To give some teams or parts of the codebase a wider or stricter limit, add overrides for teams and paths. GitHub still requires the same number of approvals for everyone.

​
People only

Turn off Automatic Approvals and set the number of required approvals you want. Turning the feature off stops new approvals but leaves CodeRabbit’s existing approvals on open pull requests. Dismiss them before you rely on people-only approval.

​
Configure GitHub

A repository administrator sets the approval requirement in GitHub, separately from CodeRabbit:
1

Open the branch rules

In the repository, go to Settings → Rules → Rulesets, then create or edit a branch ruleset and select the branches it protects. For classic branch protection, go to Settings → Branches instead.
2

Require approvals

Turn on Require a pull request before merging, then turn on required approvals and set the count for your policy.
3

Dismiss stale approvals

Turn on Dismiss stale pull request approvals when new commits are pushed, so that approvals do not carry over to changed code. CodeRabbit approves again after it reviews the new commit. Add code owner reviews and required status checks where you need them.
4

Enforce the rule

For a ruleset, set its enforcement status to Active and check its bypass list if the rule should also apply to administrators and automation. For classic branch protection, turn on Do not allow bypassing the above settings. Save the rule.
See GitHub’s documentation on branch protection rules and ruleset settings for all available controls.

​
Automate merging with Triage

Your approval policy decides who must approve a pull request. A Triage merge rule decides which pull requests CodeRabbit merges for you. The two can differ on purpose. For example:
  • Lower-risk changes need CodeRabbit and one person, and higher-risk changes need two people, as in People for higher-risk changes.
  • A Triage rule based on the Merge low-risk changes template merges only a narrower set: open pull requests with low risk and low review effort.
  • Higher-risk pull requests are merged deliberately by a person after human review.
A Triage merge rule merges only after the required checks and reviews pass, so it cannot merge a pull request that is still waiting for human approval. Its conditions control only that rule. They do not stop anyone from merging the pull request another way once the repository’s requirements are met. Triage’s Risk condition is a separate score, so a pull request can be low risk in Triage and still above your merge risk limit. Choose each setting for its own purpose: risk limits protect the review requirement, and Triage conditions decide when automation acts. Neither replaces the other.

​
What’s next

Approval risk limits

Set merge and security risk limits, with overrides for teams and paths.

Triage rules

Merge, close, or fix pull requests automatically when they match conditions you choose.

Automatic Approvals

See exactly when CodeRabbit requests changes and when it approves.